Safety CI > alphagov/notifications-api

fix_org_usage_report

4 years, 8 months ago

a01c3985

WIP Get correct sms_remainder from fetch_sms_billing_for_organisation

No dependencies with known security vulnerabilities.

master

4 years, 8 months ago

18776e41

Merge pull request #3377 from alphagov/zero-case-performance-page Fix division by zero error on per

No dependencies with known security vulnerabilities.

frequent-timeout-180344153

4 years, 8 months ago

6413e8a0

Change timeout-notifications to run every hour There's no logical constraint that prevents this: -

No dependencies with known security vulnerabilities.

frequent-timeout-180344153

4 years, 8 months ago

854e4a4f

Change timeout-notifications to run every hour There's no logical constraint that prevents this: -

No dependencies with known security vulnerabilities.

zero-case-performance-page

4 years, 8 months ago

106187ba

Fix division by zero error on performance page For preview and staging environments, we often send

No dependencies with known security vulnerabilities.

master

4 years, 8 months ago

2b6a550c

Merge pull request #3372 from alphagov/update-utils-coordinate-transformation-2 Update utils to bri

No dependencies with known security vulnerabilities.

update-utils-coordinate-transformation-2

4 years, 8 months ago

c0742fe8

Pass polygons through if they’re small already If a polygon is smaller than the largest polygon in

No dependencies with known security vulnerabilities.

update-utils-coordinate-transformation-2

4 years, 8 months ago

d6d5d44f

Pass polygons through if they’re small already If a polygon is smaller than the largest polygon in

No dependencies with known security vulnerabilities.

update-utils-coordinate-transformation-2

4 years, 8 months ago

8ed0a5f5

Pass polygons through if they’re small already If a polygon is smaller than the largest polygon in

eventlet 0.30.2 has known security vulnerabilities.

Package	Installed	Affected	Info
eventlet	0.30.2	<0.40.3	show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request.
eventlet	0.30.2	<0.37.0	show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers.
eventlet	0.30.2	<0.34.3	show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed
eventlet	0.30.2	<0.35.2	show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
eventlet	0.30.2	<0.31.0	show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

update-utils-coordinate-transformation-2

4 years, 8 months ago

c8849845

Pass polygons through if they’re small already If a polygon is smaller than the largest polygon in

No dependencies with known security vulnerabilities.

coord3

4 years, 8 months ago

3b11fc76

Pass polygons through if they’re small already If a polygon is smaller than the largest polygon in

No dependencies with known security vulnerabilities.

org-agreement-details

4 years, 8 months ago

c575887f

Remove unecessary list-routes command Since this was added, Flask now comes with a build in command

No dependencies with known security vulnerabilities.

master

4 years, 8 months ago

443f197f

Merge pull request #3376 from alphagov/update-query-for_insert_notification_history_delete_notificat

No dependencies with known security vulnerabilities.

update-query-for_insert_notification_history_delete_notifications

4 years, 8 months ago

30a58526

Update the query to only return the count from the table since that is all we care about. https://w

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-17

4 years, 8 months ago

02a9f56c

Update soupsieve from 2.2.1 to 2.3.1

No dependencies with known security vulnerabilities.